unable to access call manager version 9.1.2.12900-11 on Internet explorer

[Brastax001]

I am getting the following error message when accessing our CUCM version 9.1.2.12900-11

I am using Internet explorer and Edge.. Please assist.

This page can’t be displayed

This page can’t be displayed

• Make sure the web address https://10.x.x.x is correct.
• Look for the page with your search engine.
• Refresh the page in a few minutes.

• Check that all network cables are plugged in.
• Verify that airplane mode is turned off.
• Make sure your wireless switch is turned on.
• See if you can connect to mobile broadband.
• Restart your router.

Fix connection problems

[Jitender Bhandari]

I am suspecting something like below BUG.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuj42438/

Can you try below workaround on IE and let me know

https://support.microsoft.com/en-us/kb/3061518

HTH

JB

[Brastax001]

1. Hi Jitender, I will give it a try and let you know in the morning.. Thanks.. Much appreciate the response and suggestion.

[geeta.kumari1]

Hi Brastax001,

Did u got this issue resolved ?

Regards,

Geeta

[Brastax001]

Hi Geeta

Unfortunately no, the only fix for us was to upgrade our call manger to the latest version.

the workaround for the old versions was to use Firefox. It seems Cisco is not keeping up with Microsoft IE updates.. big concern for me as most of the end-user environments is MS based. 

Regards

Siseko

[Gilmar Silva]

Hi Jitender,


I think this is a different issue. I have two customer with the same problem.

I was able to check that this problem ocurred after some Windows updates.

It's not affecting the CUCM 10.5, but I saw it ocurring in the CUCM 9.1 and previous versions.

Unfortunatelly, until now, we don't have a workaround for the Internet Explorer, but with Firefox is working with no issues.


Regards,


Gilmar Silva

[Jitender Bhandari]

Hi Gilmar,

I have seen similar issue been reported, unfortunately i dont have exact BUG or explanation to the issue at this point but what i can tell you is it affects CUCM version 9.X and below and IE 11 with different permutations combinations. What i can tell for sure is in our lab we tested with latest 9.1(2)SU5 with IE 11 and it worked.

HTH

JB

[Gilmar Silva]

Hi Jitender,

Thank you for the feedback.

In fact, I tried to reproduce this problem with my laptop and it is working.

However, my last Windows update was in July 15.

I will keep testing and check if something changes after the next update. If so, I will do another post.

Regards,

Gilmar Silva

[Graham Old]

IE can't access Cisco tomcat

Microsoft released KB3161608 as an optional update in the June patch release. It is "June 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2"

KB3161639 "Update to add new ciphers suites to IE and Edge in Windows" which is part of KB3161608 causes problems.

This patch stops IE accessing Cisco web pages using https, the error is "This page can't be displayed"

Specifically it seems to change the minimum Diffie-Hellmen key length IE will accept from 512 bits to 1024 bits and the Cisco Tomcat server can't offer 1024.

KB3061518 talks about this and provides a registry entry which sets the minimum key length back to 512 bits

It looks like Cisco Tomcat offers a 768 bit key so you can set the registry entry to 300 (hex) and not 200

From KB3061518

To edit this registry entry, follow these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman

3. On the Edit menu, point to New, and then click DWORD Value.
4. Type ClientMinKeyBitLength for the name of the DWORD, and then press Enter.
5. Right-click ClientMinKeyBitLength, and then click Modify.
6. In the Value data box, type 00000200, and then click OK.
7. Exit Registry Editor, and then restart the computer.

I did not need to reboot

Graham

[graphictech3]

THANK YOU!  This fixed it for me!

[pros2go_llc]

Had to create new key Diffie-Hellman but the rest worked like a charm.

Many Thanks!

[EMR.Networks]

Hi thanks for the postings have been battling with this for months.

putting up with this for months and months by using Chrome have tried both registry settings 200 and 300 I..e 512 bit or 768 bit  DH key but none works.

Is there a CUCM patch I need to apply aswell ? Am running on CUCM 9.1.2

Have Win10 and WIn7 machines same problem IE V11.

Works fine in Chrome

Any help would be greatly appreciated!

[geeta.kumari1]

Hi EMR ,

Ssl3 DHE key for mozilla firefox works fine.

In the browser write" about:config"

accept on the next page

In search bar write dhe and double click to make value false.

After this you would be able to browse all UC application.

Other alternative is to generate a CSR from cucn and give to CA to create SHA2 256 certificate for tomcat and upload the same.

Restart tomcat service.

Please verify the subject name of current certificate is same as that of new certificate.

[Graham Old]

There are no patches for UCM

If you are using a proxy with IE make sure it is setup to bypass proxy server for local addresses.

Windows 7, IE11.0.9600.18524

Set the key length to 300 (hex) works, set to 400 fail.

UCM 9.1.2.11900-12

Graham

[lmediavilla]

Your solution works, thank you.